Stripe webhook debugger
Debug Stripe webhooksand verify every signature
Subscriptions, payouts and disputes depend on Stripe webhooks. Hooklistener records each event, checks the Stripe-Signature against your signing secret and lets you replay (Pro) a payload after a fix.
How Stripe webhooks work
| Signature header | Stripe-Signature, carrying a timestamp and a v1 HMAC signature computed with the endpoint's signing secret (starts with whsec_). Verify it against the raw request body. |
|---|---|
| Timestamp tolerance | Stripe's libraries reject signatures more than 5 minutes from the current time by default; the tolerance is configurable. |
| Retries | Live mode: up to three days with exponential backoff. Sandbox: three times over a few hours. |
| Manual resend | Dashboard Resend works up to 15 days after the event; stripe events resend works up to 30 days. |
| Response | Return a 2xx quickly, before any complex logic that could cause a timeout. |
Test it
Stripe's CLI forwards events to a local URL and prints its own whsec_ secret for that session. To keep a copy of each event at a public URL and tunnel it to localhost instead, point a Stripe endpoint at a Hooklistener webhook URL and run the Hooklistener tunnel.
stripe listen --forward-to localhost:4242/webhook
# or
hooklistener tunnel --port 3000Sources (checked November 2026)
Find out why a Stripe webhook failed
Stripe fires many events across a customer's lifecycle. Hooklistener keeps each one with its headers and body so engineers and support can find the missing invoice event or the stuck payout without digging through server logs.
Forward events to localhost while you build, and replay a captured event to staging or production to check new logic without waiting for live traffic. Replay is on Pro and above.
What breaks most Stripe webhook setups
Signature mismatches
Timestamp drift, a re-serialized body or the wrong signing secret all end in a 400. You need the raw request to see which one it was.
Invisible retries
Stripe retries failed deliveries. Each retry hits your handler again, and duplicate processing is easy to miss.
Hard-to-reproduce billing bugs
A failed invoice.payment_failed handler is hard to test when you have to wait for another customer's card to decline.
How Hooklistener helps you debug Stripe webhooks
Stripe signature verification
Store your Stripe signing secret (paid plans) and Hooklistener checks the Stripe-Signature header on each captured event, so a 400 from your handler shows whether the secret, the timestamp or the body is at fault.
Replay (Pro) a failed invoice event
Resend the exact Stripe invoice.payment_failed payload to localhost, staging or production after you change your billing logic, instead of waiting for another customer event.
Every Stripe retry in one history
Each Stripe retry arrives as its own captured request (history by plan), and an inactivity monitor alerts you by email, Slack or signed webhook when events stop arriving.
Try it: point Stripe at a free webhook URL or run a test with the webhook tester.
Stripe webhook workflows that benefit most
Subscription lifecycle
Check that renewals, trials and dunning sequences fire correctly by testing against real invoice events.
Marketplace payouts
Follow transfer and payout events across Connect accounts, including every retry.
Revenue reporting
Sync payment_intent and charge events to your ERP or data warehouse and confirm the event stream is complete.
Replay a failed webhook without re-triggering the provider
Once a delivery is captured, you can resend its exact headers and body to localhost, staging or production from the dashboard or through your coding agent over MCP, so the provider never has to fire a new event. Replay is on Pro and above. Read the replay guide.
Comparing webhook debugging tools?
See how Hooklistener stacks up against webhook.site, RequestBin, Beeceptor, Hookdeck and ngrok in the best tools to capture and inspect webhook payloads, or read the head-to-head pages for Hooklistener vs ngrok and Hooklistener vs Beeceptor.
Frequently asked questions
Can Hooklistener verify Stripe signatures?
Yes. Store your Stripe signing secret (paid plans) and Hooklistener checks the Stripe-Signature header on captured events, so you can see a mismatched timestamp or secret at a glance.
How long does Hooklistener keep Stripe payloads?
History depends on your plan: 1 day on Free, 14 days on Pro, 30 days on Production and 90 days on Scale. After that the requests are deleted.
Can I replay one Stripe event to several environments?
Yes. Replay is on Pro and above. Send a captured Stripe event to localhost, QA or production without re-triggering a live payment, and use auto-forwarding to copy new events to another URL as they arrive.
Does this help support teams?
Yes. Support can search the request history for a charge, refund or dispute event, or open a shareable debugger link an engineer sends them.
Never guess what Stripe actually sent
Capture your first Stripe webhook in minutes, verify its signature and forward it to localhost.